Privacy Policy

Privacy Policy for My Mortgage Specialist

Why should you read this document?

During the course of dealing with us, we may ask you to provide personal information about your circumstances, financial position, credit history, mortgage requirements and, where relevant, protection needs.

This privacy policy explains what personal data we collect, how we use it, who we may share it with, how long we keep it for, and the rights you have in relation to your personal data.

My Mortgage Specialist Ltd provides mortgage advice and may also arrange protection products through third-party providers.

Who we are

My Mortgage Specialist Ltd is responsible for the personal data we collect and use.

My Mortgage Specialist Ltd is authorised and regulated by the Financial Conduct Authority under Firm Reference Number 1002905 and is an Appointed Representative of TMG Direct Limited, which is authorised and regulated by the Financial Conduct Authority under Firm Reference Number 786245.

If you have any questions about this privacy policy or how we use your personal data, please contact:

What personal data we may collect

The personal data we collect will depend on your enquiry, circumstances and the mortgage or protection service you ask us to provide.

This may include:

• your name, title, date of birth and contact details
• your address history
• your employment status and income details
• your financial circumstances, including income, expenditure, debts and commitments
• information about your deposit, property plans, mortgage needs and affordability
• information about your credit history, which may include missed payments, defaults, CCJs, IVAs, bankruptcy, repossession history or debt management plans
• documents needed to verify your identity, income, address or financial position
• information needed for identity, credit, fraud, anti-money-laundering and sanctions checks
• information you provide through website forms, Facebook / Meta lead forms, phone calls, email or WhatsApp
• notes, messages, call recordings and updates recorded during the advice process
• health, medical, lifestyle or family medical history information, where this is relevant to protection products

We only collect information that is needed to respond to your enquiry, provide advice, progress your application, meet legal or regulatory obligations, manage our relationship with you and keep appropriate records.

Health and medical information for protection products

Where you ask us to help with protection products, such as life insurance, critical illness cover or income protection, we may need to collect information about your health, medical history, lifestyle and, where relevant, family medical history.

This type of information is known as special category data under data protection law.

We will only collect and use this information where it is relevant to the protection advice or application you have asked us to help with.

We may share relevant information with protection providers, insurers or related product providers so they can assess your application, provide terms, make underwriting decisions or administer the product.

We will not use health or medical information for general marketing.

How we collect your personal data

We may collect personal data from:

• you directly
• website enquiry forms on the My Mortgage Specialist website
• Facebook / Meta lead forms
• telephone calls
• email
• WhatsApp messages
• referrals from previous clients or other contacts
• credit reference agencies
• lenders, banks, financial institutions or other mortgage-related third parties
• protection providers or insurers, where relevant
• sanctions screening sources
• public sources where relevant, such as electoral roll information

Our website enquiries are sent into our CRM system, FLG. Facebook / Meta lead form data may be transferred using Zapier into systems such as FLG and Google Drive.

Systems we use

We use systems and service providers to help manage enquiries, client records, communications, documents, advice cases and compliance records.

These may include:

• FLG, our CRM and email/client update system
• OMS
• Zapier, where used to transfer lead data between systems
• Google Drive
• Dropbox
• Box
• email systems
• WhatsApp, where messages are sent manually
• website enquiry forms
• Facebook / Meta lead forms
• Google Analytics
• Meta Pixel

We use these systems to record enquiries, manage client information, send updates, store documents, record notes, support case management and maintain appropriate business records.

How we use FLG

My Mortgage Specialist uses FLG as its customer relationship management system. FLG is used to record client information, enquiry details, notes, messages, updates and email communications.

We use FLG to help manage enquiries, communicate with clients, record advice activity, manage mortgage and protection cases, send relevant updates and maintain appropriate business records.

Why we use your personal data

We may use your personal data to:

• respond to your enquiry
• understand your mortgage or protection needs
• assess which mortgage or protection options may be suitable
• carry out initial checks or fact-finding
• communicate with you by phone, email, WhatsApp or other agreed methods
• send your information to lenders, banks or financial institutions so they can assess your case
• send your information to protection providers or insurers where relevant
• help obtain mortgage quotes, decisions in principle, mortgage offers or protection terms
• carry out identity, credit, fraud prevention, anti-money-laundering or sanctions checks where needed
• manage your case and keep records of the advice and service provided
• respond to questions, complaints or claims
• meet our legal, regulatory and compliance obligations
• provide service updates or relevant information about mortgage or protection-related services
• improve our website, systems and client experience
• run website analytics, advertising measurement and remarketing activity

Our lawful basis for using your personal data

We use different lawful bases depending on why we are using your personal data.

To provide mortgage, protection and related services

We may use your personal data because it is necessary to take steps before entering into a contract with you, or to perform our contract with you.

We may also rely on legitimate interests where we need to use your data to respond to enquiries, understand your needs, progress your case, manage our records, check advice quality and provide a professional advice service.

To meet legal and regulatory requirements

We may use your personal data where we have a legal or regulatory obligation to do so.

This may include identity checks, fraud prevention, anti-money-laundering checks, sanctions checks, complaint handling, FCA requirements, HMRC requirements, ICO requirements and requests from regulators or other official bodies.

To handle queries, complaints or claims

We may use your personal data to answer questions, investigate complaints, keep complaint records, deal with the Financial Ombudsman Service, manage claims, fix issues and improve our service.

We may rely on legal obligation and legitimate interests for this processing.

For service updates and relevant information

We may use legitimate interests to send service updates or relevant mortgage and protection-related information where this is connected to your enquiry, existing product or relationship with us.

We may also send occasional updates by email using FLG where the information is relevant to mortgage, protection or related services.

Where we send marketing that requires consent, we will ask for your consent. You can object to marketing or withdraw your consent at any time.

Service messages relating to your enquiry, application, product, legal obligations or regulatory requirements may still be sent where necessary.

Credit checks, fraud checks and sanctions checks

As part of providing mortgage or protection advice, we may use information about your credit history to understand which lenders or providers may be able to consider your circumstances.

We may share data with credit reference agencies, and credit searches or soft searches may be carried out where needed. This may help lenders, banks, financial institutions or providers assess your application, identity, affordability, credit profile and suitability against their criteria.

This is particularly relevant where a client has adverse credit history, such as CCJs, defaults, missed payments, IVAs, bankruptcy, repossession history or debt management plans.

We may also carry out checks to verify your identity, prevent fraud, meet anti-money-laundering requirements and check sanctions lists.

Where a lender, bank, financial institution, insurer or protection provider carries out its own checks, they may also process your personal data under their own privacy notice.

Call recording

We may record phone calls for training, monitoring, compliance, record-keeping, complaint handling and service quality purposes.

We may also record notes of calls and messages in FLG or our other systems to help manage your enquiry, provide advice, progress your case and keep appropriate records.

Who we may share your personal data with

We may share your personal data with third parties where needed to provide our services, progress your enquiry or application, meet legal or regulatory obligations, or manage our business.

This may include:

• mortgage lenders
• banks and financial institutions
• protection providers and insurers
• credit reference agencies
• fraud prevention agencies and sanctions screening providers
• TMG Direct Limited / TMG Mortgage Network for compliance, supervision and network oversight
• FLG
• OMS
• Zapier
• Google Drive
• Dropbox
• Box
• website, analytics and advertising technology providers, including Google Analytics and Meta Pixel
• professional advisers, auditors, compliance advisers or consultants
• regulators and official bodies, including the FCA, ICO, HMRC, Financial Ombudsman Service and Financial Services Compensation Scheme where applicable

We do not share your personal data with other organisations unless there is a valid reason to do so.

Third parties should not use your personal data for their own marketing unless they have their own lawful basis to do so.

Referrals

We may receive enquiries through referrals from previous clients, contacts or other third parties.

Where a referral is made, we will use the personal data provided to contact you about your mortgage or protection enquiry.

We will not assume you wish to receive ongoing marketing unless you have consented or another lawful basis applies.

WhatsApp, phone and email communication

We may contact you by phone, email or WhatsApp where appropriate. WhatsApp messages are sent manually by the firm.

If you provide a preferred contact method, we will normally try to use that method where practical.

We may record notes of conversations and messages in FLG to help manage your enquiry, provide advice, progress your case and keep appropriate records.

Marketing and service updates

After you make an enquiry, we may contact you about your mortgage or protection enquiry and related service updates.

We may also send occasional updates by email where the information is relevant to mortgage, protection or related services.

You can ask us to stop sending marketing messages at any time.

Service messages relating to your enquiry, application, product, legal obligations or regulatory requirements may still be sent where necessary.

How long we keep your personal data

We keep client records for six years, or permanently where we have a legal or regulatory requirement or right to do so.

We may keep some records for longer where needed for complaints, claims, FCA checks, audit purposes, compliance monitoring or to prove the advice and service provided.

How we keep your personal data secure

We take reasonable steps to protect your personal data from unauthorised access, loss, misuse or disclosure.

Access to client information is restricted to people who need it for their role.

We use systems such as FLG, OMS, Google Drive, Dropbox and Box to manage client data, documents and communications. We also expect our suppliers and processors to apply appropriate security controls.

You should also take care when sending sensitive information to us. For example, avoid sending confidential documents over unprotected email where possible, and consider using password protection or secure transfer methods for sensitive documents.

International transfers

We do not intend to transfer your personal data outside the UK or European Economic Area unless this is necessary because of the systems, suppliers or service providers we use.

Where personal data is transferred internationally, we will expect appropriate safeguards to be in place.

Your rights

You have rights in relation to your personal data. These may include the right to:

• request a copy of the personal data we hold about you
• ask us to correct inaccurate or incomplete personal data
• ask us to delete your personal data in certain circumstances
• ask us to restrict how we use your personal data in certain circumstances
• object to our use of your personal data in certain circumstances
• ask us to transfer your personal data to another organisation where applicable
• withdraw consent where we rely on consent
• object to direct marketing

Some rights may not apply in all circumstances, especially where we need to keep data to meet legal, regulatory, complaint-handling or record-keeping obligations.

How to contact us about your data

If you have any questions about this privacy policy, how we use your personal data, or if you wish to exercise your rights, please contact:

If we believe we have a legal or regulatory reason not to deal with your request, or to deal with it in a different way, we will explain this to you.

You should also contact us as soon as possible if you become aware of any unauthorised disclosure or misuse of your personal data.

Complaints

If you are unhappy with how we have handled your personal data, please contact us first so we can look into your concerns.

You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator.

You can contact the ICO through its website or by writing to:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF